PRIVACY POLICY

Effective date: 23.06.2026
Last updated: 21.09.2026

1) Who we are and how to contact us

The personal data controller (Art. 4(7) of the General Data Protection Regulation /GDPR/) is
“FERRYONE” OOD, UIC 208212295, with registered office and address of management:
Sofia, Izgrev District, 13B “Tintyava” St., apt. ground floor.

Website: www.ferryone.com
Privacy email: privacy@ferryone.com
General support: support@ferryone.com

The company is registered as a travel agent in the Register of Tour Operators and Travel Agents, part of the National Tourism Register of the Republic of Bulgaria – Registration Certificate No. RK-01-8584, issued on 30.05.2025.

This Policy applies to our website, mobile applications and related online services (the “Platform”).

2) What we process, why, and on what legal basis

We process only the data necessary for specific and lawful purposes, including search, booking, payment, ticket/travel document issuance and delivery, customer support, changes, cancellations, refunds, complaints, security, accounting, legal obligations and improvement of the Platform.

Legal bases: contract or steps before entering into a contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), legal obligation (Art. 6(1)(c) GDPR).

Roles under the GDPR: FERRYONE processes personal data as a controller for its own services, including the Platform, accounts, booking flow, support, payments, security, accounting and communications. Depending on the specific service, ferry operators, carriers, booking systems, technical/API/GDS providers, distribution partners, insurance partners, payment providers and other providers may act as independent controllers, joint controllers or processors under the relevant contractual and legal framework.

2.1. Visiting the site/apps (logs and security)

Data: IP address, date/time, URL/referrer, session identifier, device/browser identifier, OS, language, basic device information, approximate technical location, access logs, errors, crash/diagnostic data, cookie consent status and other technical data necessary for operation and security.
Purposes: content delivery, normal operation of the Platform, protection against abuse/fraud, prevention of unauthorized access, diagnostics, load, performance, monitoring of technical incidents and evidence of actions in case of dispute.
Basis: legitimate interest (security, continuity, abuse prevention and technical support); legal obligation where required by law.
Retention: up to 90 days for standard server logs; in case of incident, dispute, abuse or legal requirement – until the investigation, dispute or respective legal obligation is completed.
Recipients: hosting/cloud providers, logging/monitoring providers, security tools, technical support and competent authorities, where applicable.

2.2. Registration/sign in and account (incl. social login)

How you sign in: sign in via Google, Facebook or Apple (without separate email/password registration), where such functionality is available. Under the sign in buttons we display links to the “Terms of Use” and the “Privacy Policy.” By default, only strictly necessary technologies are loaded (see § 3).

What data we receive from the IdP: name, email (with “Hide My Email” possible when using Sign in with Apple), your unique identifier with the respective IdP, technical markers for sign in, security and session. We never receive your password and do not post on your behalf.

Account details and Booking contact details: Your account data (“Account details”) is separate from the contact data for a specific Booking (“Booking contact details”). Changes to your account do not automatically change already made Bookings, because each Booking keeps its own snapshot of the data submitted at purchase.

Additional data (optional/where available): phone for operational contact, preferred contact channel, saved contacts, passengers, vehicles or other reusable templates for future Bookings. Such data is used for convenience and does not automatically change past Bookings.

Purposes: create and maintain an account, sign in, link Bookings to account, access My bookings, security, customer support, autofill for future Bookings where available.
Basis:
- Art. 6(1)(b) GDPR (sign in, account, servicing Bookings);
- Art. 6(1)(f) GDPR (security, abuse prevention, technical continuity);
- Art. 6(1)(a) GDPR (consent-based features – e.g., marketing push, marketing personalization, optional saved templates where applicable).
Retention: account data – until account deletion; saved templates/contacts/passengers/vehicles – while you keep them in the account or until deletion; session tokens and access logs – up to 90 days; backups – up to 30 days after deletion, unless a longer period is required by law or dispute.
Recipients: Google, Meta (Facebook) and Apple are independent controllers for your accounts with them; we use the data received only for the purposes above.

2.3. Bookings and payments

Data: names, contacts, booking contact details, booking code, operator/system reference, route, date, time, departure/arrival port, booking status, ticket status, price, fees, FERRYONE service fee, additional services, refund/change/cancellation status, booking communications and invoicing/accounting data.
Passenger data: first and last name as shown in the document, date of birth, age category, citizenship/nationality, gender, document type, document number, document validity, country/place of birth and other data where required by the ferry operator, booking system, law or port/border authorities.
Vehicle data: type/category, make, model, registration number, dimensions, height, length, trailer, roof box, bike rack, external equipment, fuel or other characteristics where necessary for the Booking.
Pet data: type/count/category and other data where required according to the operator’s, route’s or vessel’s rules.
Special assistance data: where you expressly provide information about special assistance, reduced mobility, wheelchair, medical equipment, companion or other sensitive information, we process it only to the extent necessary to pass the request to the relevant operator/Supplier and organize assistance. We do not request medical diagnoses unless necessary and legally permitted. Where such information constitutes special category data under Art. 9 GDPR, we process it based on your express provision/consent and/or another applicable basis permitted by law.
Payment data: we do not store full bank card data and we do not store CVV/CVC codes.
Purposes: search for availability and prices; create, confirm and manage a Booking; payment; issuance and delivery of a ticket, e-ticket, PTA, voucher, booking reference or other travel document; performance of travel; booking communication; changes, cancellations and refunds; special assistance; complaints; customer support; accounting; claims defense and evidence of performance.
Basis: contract or steps before entering into a contract; legal obligation (accounting, taxes, lawful requests); legitimate interest (evidence of performance, claims defense, abuse prevention); consent or express provision by you where special assistance information or optional saved templates are processed.
Payments through DSK Bank and Stripe: Payments are processed by the selected payment provider — DSK Bank AD or Stripe. With Stripe, payment details are entered in an embedded form provided by Stripe and sent directly to Stripe. Full card numbers and CVV/CVC codes do not pass through FERRYONE’s servers and are not stored by us. We process limited transaction information: payment status, identifier, amount, date/time, payment attempt status and technical information needed to process, evidence and account for the payment.

The payment provider processes the details entered in its interface, transaction data and technical data required for payment, authentication and fraud prevention. Use of an external wallet or another payment method is also subject to the relevant provider’s privacy policy. For information about processing by Stripe, see the Stripe Privacy Policy.
Refunds: Where a refund is due, it is made to the original payment method unless applicable law or the payment process requires otherwise. This also applies when another person made the payment. Information processed may include refund status and amount, reason, date, payment identifier and communications with the payment provider, operator or booking system.
Retention: booking data – up to 5 years (for claims defense and operational history); accounting records – up to 10 years; communications regarding a specific Booking – up to 24 months after completion, unless needed to protect rights, handle a complaint, dispute or legal obligation.
Recipients: ferry operators/carriers; booking systems; technical/API/GDS providers; distribution partners; payment providers, including DSK Bank AD and Stripe; insurance partners or providers of additional services if you have selected such a service; hosting/email/support providers; accountants, legal advisers and competent authorities where necessary.

2.4. Support, communications, complaints and claims

Data: names, email/phone, booking code/reference, ticket number, passenger name, travel date, inquiry content, complaint description, attachments, photos/documents, chat/ticket records, communication history, source page and technical data related to the request.
Purposes: customer support, responses to inquiries, assistance with changes, cancellations, refunds, special assistance, complaints, passenger rights, communication with operator/booking system/Supplier, evidence of actions performed and protection of rights.
Basis: contractual actions; legitimate interest (support, evidence of performance, claims defense); legal obligation where applicable.
Retention: up to 24 months from the last correspondence; in case of dispute, complaint, chargeback, claim or legal obligation – until completion and expiry of applicable limitation periods.
Recipients: the relevant ferry operator/carrier, booking system, technical/API/GDS provider, insurance partner, payment provider or other Supplier where necessary to handle the case. The relevant operator or Supplier may contact the customer or contact person directly regarding travel-related information, including changes, delays, cancellations, boarding instructions, passenger rights, safety notices or other operational messages.

2.5. Marketing, personalization and statistics

Analytics/diagnostics (server logs): aggregated events and logs for stability, performance and improvements without accessing the device – legitimate interest; retention up to 14 months, unless a shorter or longer period is required for security/incident reasons.
Analytics/SDK/cookies: when measurement requires storing or accessing information on the end-user device (cookies, SDK, IDFA, AAID or similar technologies), we enable it only after consent.
Advertising and measurement (Meta/Google and others): advertising pixels, conversion tracking, remarketing, audience tools and advertising measurement are enabled only after consent in “Cookie Settings” or the applicable consent flow. Without consent we do not load advertising tags/pixels/SDKs and do not use advertising identifiers for these purposes.
Email newsletter/marketing messages: sent with express sign up (consent) or under permissible soft opt-in to our own customers for similar services where the law allows this and we provide an opt-out at collection and in every message.
Retention: marketing profiles/identifiers – up to 12 months or until consent is withdrawn; marketing consent/withdrawal logs – as long as necessary to evidence the choice and comply with the law.

2.6. Third party data (co travelers, passengers, children, contact persons)

If you provide personal data of third parties (e.g., co travelers, children, other passengers, contact persons or owners/users of a vehicle), you confirm that you are authorized to do so and, where applicable, that you have informed them about this Policy.

Where we have their contacts and this is necessary or required by law, we may provide them with the information under Art. 14 GDPR within the time limits set by law. In some cases this may be done through you as the person who provided the data and organizes the Booking.

Payment by another person via a link: If you send the payment link to another person, you give them access without signing in to a payment screen showing the route, ports, dates/times and total amount payable. Passenger names and contact details are not displayed on this screen. Send the link only to the intended payer. Payment details they enter are processed by the selected payment provider, while FERRYONE processes limited transaction information as described in section 2.3.

The data is used to carry out and account for payment, process any refund, service the Booking and prevent misuse. The applicable bases are performance of a contract or steps requested by the individual before entering into one, where that basis applies; statutory accounting obligations; and our legitimate interest in accepting an authorised payment for a Booking and protecting the parties against fraud. The retention periods for payment data and logs in section 7 apply. Payment alone does not confer the right to manage another person’s Booking; sections 5.5–5.6 of the Terms apply.

3) Cookies and similar technologies

We use cookies, local storage, session storage, SDKs, pixels and similar technologies. Detailed information is available in the Cookies Policy.

Main categories:

Strictly necessary – required for security, navigation, language preferences, session, sign in, booking flow, checkout, payment flow, cookie consent storage and the basic operation of the Platform. They are always active and cannot be disabled through the cookie banner.
Analytics – help us understand how the Platform is used and improve the website and booking experience. They are loaded only after consent.
Advertising and measurement – used for Google Ads conversion tracking, Meta Pixel, remarketing, advertising performance measurement and similar purposes. They are loaded only after consent.

When you select Stripe at the payment step, its payment component loads regardless of your analytics and advertising choices. Rejecting those optional categories does not prevent the payment you request. This does not mean that every technology used by the payment provider is essential. The distinction by purpose is described in the Cookies Policy.

Your control:

Web: “Cookie Settings” menu with buttons “Accept all” / “Reject optional” / “Customize.”
Apps: control through OS settings (App Tracking Transparency / Advertising ID), as well as through the “Privacy” menu, if available.

Retention:

FERRYONE’s essential technologies — session or up to 12 months; durations for external payment providers’ technologies depend on the specific technology and are described in the relevant provider’s policies;
Analytics – up to 14 months;
Advertising and measurement – according to the provider, typically 6–12 months;
Cookie consent logs – up to 12 months or until the next material change/new consent version.

We maintain an up-to-date Cookie List on the website where applicable.

4) Mobile apps and store requirements

iOS (Apple): we use IDFA only with consent under App Tracking Transparency where applicable.
Android (Google Play): we use the Advertising ID only with consent for marketing/advertising measurement where applicable; you can reset/limit it from OS settings.
Sign in with Apple: the protected email (“Hide My Email”) is used only for your account, Bookings, tickets, support and related communications.
Data Safety/Privacy Labels: store disclosures should reflect the data actually collected and your choices.

5) Recipients and categories of providers

We may share personal data only where necessary for the purposes under this Policy and subject to appropriate contractual/legal safeguards:

Ferry operators/carriers: for search, booking, ticket issuance/change, travel performance, boarding, special assistance, complaints, passenger rights, changes, cancellations and refunds.
Booking systems, technical/API/GDS providers and distribution partners: for access to schedules, prices, availability, fare rules, booking creation, ticket issuance, PTA/e-ticket/voucher, changes, cancellations, refunds and back-office processes.
Payment services: DSK Bank AD and Stripe — payment processing, authentication, fraud prevention, refunds and payment disputes. Depending on the activity, Stripe may act as a processor on our behalf or as an independent controller for its own purposes described in its Privacy Policy.
Insurance partners and providers of additional services: where you select insurance, an add-on, support service, notification service or another additional service.
Hosting/logs/monitoring: AWS or other cloud/infrastructure providers (mainly EU regions).
Sign in, communication and productivity services: Google, Meta/Facebook, Apple, email delivery, support/admin tools, if used for the respective functionality.
Advertising/measurement: Meta Platforms, Google and other advertising/measurement providers – only with consent where required.
Advisers and authorities: accountants, legal advisers, auditors, banks, payment institutions, public and supervisory authorities where necessary or required by law.

Joint and independent controllers:

Ferry operators, carriers, payment providers, insurers, Google, Meta, Apple and other providers may act as independent controllers for their own purposes where they determine the purposes and means of processing.
Meta Business Tools and Google Ads/Conversions may involve joint or independent controller regimes according to the applicable terms. These technologies are enabled only with consent where required.
Technical/API/GDS providers, hosting, support and email providers may act as processors on our behalf where they process data only on our instructions.

6) Where we process and transfers outside the EEA

Data is stored and processed mainly in the EU/EEA, including through cloud providers in EU regions where applicable.

Where transfer outside the EU/EEA is necessary (e.g., to Google, Meta, Apple, technical/API/GDS providers, support tools or other partners), we apply appropriate mechanisms under the GDPR, including adequacy decisions, Standard Contractual Clauses (SCC), mechanisms under the EU–US Data Privacy Framework for certified recipients, additional security measures, minimization, encryption and restricted access.

Processing by Stripe may involve international transfers. Information about the applicable safeguards and your rights in relation to Stripe’s processing is available in the international transfers section of its Privacy Policy.

7) Maximum retention periods

Server logs/security: up to 90 days; in case of incident, abuse or dispute – until completion/requirement.
Cookie consent logs: up to 12 months or until a new version/material change of the consent choice.
Analytics (aggregated/anonymized): up to 14 months, unless provider settings or law require another period.
Account/settings: until account deletion + up to 30 days in backups.
Saved contacts/passengers/vehicles/templates: while you keep them in the account or until deletion.
Communications and support: up to 24 months from the last correspondence.
Complaints/disputes/chargebacks: until completion of the case and expiry of applicable limitation periods.
Marketing profiles/identifiers: up to 12 months or until consent is withdrawn.
Bookings, tickets, booking history, change/cancellation/refund history: up to 5 years (for claims defense and operational history).
Payment references and payment/refund logs: up to 5 years or longer if part of accounting records, dispute or legal obligation.
Accounting and tax documents: up to 10 years.

If required by law, dispute, audit, inspection or protection of rights – we may keep data longer only to the extent necessary.

8) Security of processing

We apply technical and organizational measures, including:

TLS encryption in transit;
encryption of data at rest in cloud infrastructure where applicable;
segmentation in AWS VPC or equivalent infrastructure;
key/secret rotation;
access control (least privilege);
multi-factor authentication for administrative access where applicable;
monitoring, alerts, logging and tests;
access limited only to persons with a business need and confidentiality obligation.

We do not store full bank card data and we do not store CVV/CVC codes. Card data is entered in the secure payment environment of the payment provider.

Incidents: in case of a personal data security breach, we will notify the CPDP and affected individuals where required by Art. 33 and 34 GDPR, and we will assist in mitigating the risk.

9) Minors

The Platform is intended for persons aged 18+. We do not create user accounts for children.

Data about children/minors may be provided only by a parent, guardian, custodian or another authorized adult in connection with a specific Booking and is processed to the extent necessary for search, booking, ticket issuance, travel performance, special assistance, legal obligations or operator/carrier requirements.

We do not use children’s data for marketing. If you suspect unauthorized submission – write to privacy@ferryone.com.

10) Automated decisions and profiling

We do not make decisions solely on the basis of automated processing that produce legal or similarly significant effects for you within the meaning of Art. 22 GDPR.

Profiling may be used only for marketing personalization, advertising and measurement and only with consent where required.

Prices, availability, fare rules, confirmations, changes, cancellations and refunds may be determined by external operators, booking systems, API/GDS providers or payment providers according to their rules and system processes. FERRYONE does not make an independent automated decision with legal or similarly significant effect based solely on such data.

11) Your rights

You have the following rights under the conditions and limitations of the GDPR and applicable law:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to portability;
right to object;
right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
right to receive information about recipients to whom data has been disclosed where applicable.

How to exercise: write to privacy@ferryone.com.
We may require reasonable identity verification. We respond within 1 month, which may be extended by up to 2 months in case of complexity or a large number of requests, of which we will notify you.

Please note that some rights may be limited where data is necessary for performance of a Booking, ticket issuance, accounting, legal obligation, claims defense, security logs, fraud prevention or where data has already been transferred to an independent controller such as a ferry operator, payment provider or insurer. In such cases we may also direct you to the relevant independent controller.

Right to lodge a complaint:
Commission for Personal Data Protection (CPDP)
Sofia 1592, 2 “Prof. Tsvetan Lazarov” Blvd.
www.cpdp.bg • kzld@cpdp.bg

12) Updates to the Policy

We may update this Policy due to changes in the Platform, services, operator model, providers, technologies, legal requirements or internal processes.

We will always indicate the “Last updated” date. For material changes, we will notify you in an appropriate manner, for example via banner, notice in the Platform or email where applicable.

13) Privacy contacts

Controller: “FERRYONE” OOD, UIC 208212295
Address: Sofia, Izgrev District, 13B “Tintyava” St., apt. ground floor
Email: privacy@ferryone.com
Support: support@ferryone.com

This Policy is adopted by “FERRYONE” OOD and enters into force as of the “Last updated” date stated above.

END